Windows 7 deprecation

Windows 7 will be removed from tria.ge on 2025-03-31

Analysis

  • max time kernel
    149s
  • max time network
    138s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    15/09/2022, 00:40

General

  • Target

    1335c2fe67ffc6a6d586e4359311f2dc2473975209d1028f147c4d80b890bcbb.exe

  • Size

    718KB

  • MD5

    ba041360bc271baae8ac03abc97c6fcd

  • SHA1

    5e3c779273edf5ecc7602fb4fc748f563147a70d

  • SHA256

    1335c2fe67ffc6a6d586e4359311f2dc2473975209d1028f147c4d80b890bcbb

  • SHA512

    dcd666214999d4d80e5cdead5588074e6b314b77006abfe719c1eb1c500525dfc2dda9faaa13cd95be250fc8fbba38ade90c171d36d1596fa178aacd16eb424f

  • SSDEEP

    768:rZmchlXKGREW6VA6joSRhFH+C9Pe2auEqainmngYWxuv8Gwmwoe9R4ZstojtfcWv:schl6M+lpDCUoHid0bIrlyR

Score
8/10

Malware Config

Signatures

  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 9 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Creates scheduled task(s) 1 TTPs 5 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1335c2fe67ffc6a6d586e4359311f2dc2473975209d1028f147c4d80b890bcbb.exe
    "C:\Users\Admin\AppData\Local\Temp\1335c2fe67ffc6a6d586e4359311f2dc2473975209d1028f147c4d80b890bcbb.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4788
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe" /C chcp 1251 & powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost" & powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4940
      • C:\Windows\SysWOW64\chcp.com
        chcp 1251
        3⤵
          PID:4384
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "$ENV:USERPROFILE\Desktop"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4256
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\Dllhost"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4776
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -Command Add-MpPreference -ExclusionPath "C:\ProgramData\HostData"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:1340
      • C:\ProgramData\Dllhost\dllhost.exe
        "C:\ProgramData\Dllhost\dllhost.exe"
        2⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:4444
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:416
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "SecurityHealthSystray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:3128
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:492
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefender" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:5040
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2080
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "WmiPrvSE" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:5008
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:2676
          • C:\Windows\SysWOW64\schtasks.exe
            SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareServiceExecutable" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            4⤵
            • Creates scheduled task(s)
            PID:5044
        • C:\Windows\SysWOW64\cmd.exe
          "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
          3⤵
            PID:4852
          • C:\Windows\SysWOW64\cmd.exe
            "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftEdgeUpd" /TR "C:\ProgramData\Dllhost\dllhost.exe"
            3⤵
              PID:4920
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
              3⤵
                PID:3572
                • C:\Windows\SysWOW64\schtasks.exe
                  SCHTASKS /CREATE /SC HOURLY /TN "OneDriveService" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  4⤵
                  • Creates scheduled task(s)
                  PID:4752
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                3⤵
                  PID:4268
                • C:\Windows\SysWOW64\cmd.exe
                  "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "AntiMalwareSericeExecutable\AntiMalwareSericeExecutableService_bk841" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  3⤵
                    PID:1468
                  • C:\Windows\SysWOW64\cmd.exe
                    "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "MicrosoftUpdateServices\MicrosoftUpdateServicesService_bk6282" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                    3⤵
                      PID:4988
                    • C:\Windows\SysWOW64\cmd.exe
                      "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "SettingSysHost\SettingSysHostService_bk6249" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                      3⤵
                        PID:2228
                      • C:\Windows\SysWOW64\cmd.exe
                        "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "WindowsDefenderServices\WindowsDefenderServicesService_bk3731" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                        3⤵
                          PID:4292
                        • C:\Windows\SysWOW64\cmd.exe
                          "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                          3⤵
                            PID:644
                            • C:\Windows\SysWOW64\chcp.com
                              chcp 1251
                              4⤵
                                PID:4528
                            • C:\Windows\SysWOW64\cmd.exe
                              "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                              3⤵
                                PID:1388
                                • C:\Windows\SysWOW64\chcp.com
                                  chcp 1251
                                  4⤵
                                    PID:852
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /c chcp 1251 & C:\ProgramData\Dllhost\winlogson.exe --config msi.bin --log off
                                  3⤵
                                    PID:2304
                                    • C:\Windows\SysWOW64\chcp.com
                                      chcp 1251
                                      4⤵
                                        PID:1604

                                Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • C:\ProgramData\Dllhost\dllhost.exe

                                  Filesize

                                  896KB

                                  MD5

                                  5e38c6081788423519256d2bdedae7b8

                                  SHA1

                                  f74b429a59057d33c2ef5c34f75040b8cf956aae

                                  SHA256

                                  2c412977976da5455727cf7c5afced75c62e51b2e9792b964c98e549b880abd5

                                  SHA512

                                  f110df24f102ee510ca1ea4e1ca426c14dbdb2b03ef81c74124e708583031c45b117bb2f5c77f15a17b931abb3b0c8c2ad677bacb3a756e723e367b4add35bdb

                                • C:\ProgramData\Dllhost\dllhost.exe

                                  Filesize

                                  896KB

                                  MD5

                                  5e38c6081788423519256d2bdedae7b8

                                  SHA1

                                  f74b429a59057d33c2ef5c34f75040b8cf956aae

                                  SHA256

                                  2c412977976da5455727cf7c5afced75c62e51b2e9792b964c98e549b880abd5

                                  SHA512

                                  f110df24f102ee510ca1ea4e1ca426c14dbdb2b03ef81c74124e708583031c45b117bb2f5c77f15a17b931abb3b0c8c2ad677bacb3a756e723e367b4add35bdb

                                • C:\ProgramData\HostData\logs.uce

                                  Filesize

                                  497B

                                  MD5

                                  13fda2ab01b83a5130842a5bab3892d3

                                  SHA1

                                  6e18e4b467cde054a63a95d4dfc030f156ecd215

                                  SHA256

                                  76973d42c8fceceab7ec85b3d01b218db92564993e93a9bea31c52aa73aeee9e

                                  SHA512

                                  c51f9fd6e452fbeeedd4dfaba3c7c887e337f01e68abdd27d4032f8be85def7ef3cf0c77bf60e425b085b76c0539464c6b6e5e805a69397c5519e8ccf9fffccc

                                • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

                                  Filesize

                                  2KB

                                  MD5

                                  1c19c16e21c97ed42d5beabc93391fc5

                                  SHA1

                                  8ad83f8e0b3acf8dfbbf87931e41f0d664c4df68

                                  SHA256

                                  1bcd97396c83babfe6c5068ba590d7a3f8b70e72955a9d1e4070648e404cbf05

                                  SHA512

                                  7d18776d8f649b3d29c182ff03efc6cea8b527542ee55304980f24577aae8b64e37044407776e220984346c3998ace5f8853afa58c8b38407482a728e9495e0c

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  18KB

                                  MD5

                                  dc32a421d1e97cb88049f287757e0234

                                  SHA1

                                  d5eb5ac51dad7a100b13d16973972f3a6e042a06

                                  SHA256

                                  c8546ee958d243dee295515c6471a4304576afbea08626695dfc6e1d51d11134

                                  SHA512

                                  e47b5a86ec070d68033ec3aff056b9f5e6e591fbc2dda74a7beed90d8c4365f3c76248e9394dc32ed0648d2ce96855f32e0925a70610bdf3a25110eaded78953

                                • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                                  Filesize

                                  18KB

                                  MD5

                                  0bab097c994d7d66c6ceec25ab2b0b0b

                                  SHA1

                                  e9800b6c1afe315231a7648cfff24e24ca30c99c

                                  SHA256

                                  44e50e91c493dffc88c7d05e89f462e21d9441becf5d014aeab83531a87ed0d8

                                  SHA512

                                  0bd26e21156c9a9e062ac58416e3c8be6838cf26092f4af4ce2401207238780869c9ce387a147a98ddecc06ab546415bcb994695ef2a4ede6ad1d37ed182941e

                                • memory/4256-187-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4256-259-0x0000000008790000-0x00000000087DB000-memory.dmp

                                  Filesize

                                  300KB

                                • memory/4256-222-0x0000000005290000-0x00000000052C6000-memory.dmp

                                  Filesize

                                  216KB

                                • memory/4256-227-0x0000000007A60000-0x0000000008088000-memory.dmp

                                  Filesize

                                  6.2MB

                                • memory/4256-244-0x00000000079B0000-0x00000000079D2000-memory.dmp

                                  Filesize

                                  136KB

                                • memory/4256-247-0x0000000008090000-0x00000000080F6000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/4256-248-0x0000000008350000-0x00000000086A0000-memory.dmp

                                  Filesize

                                  3.3MB

                                • memory/4256-506-0x0000000009DC0000-0x0000000009DC8000-memory.dmp

                                  Filesize

                                  32KB

                                • memory/4256-501-0x0000000009DD0000-0x0000000009DEA000-memory.dmp

                                  Filesize

                                  104KB

                                • memory/4256-298-0x0000000009E20000-0x0000000009EB4000-memory.dmp

                                  Filesize

                                  592KB

                                • memory/4256-294-0x0000000009980000-0x0000000009A25000-memory.dmp

                                  Filesize

                                  660KB

                                • memory/4256-285-0x0000000009910000-0x000000000992E000-memory.dmp

                                  Filesize

                                  120KB

                                • memory/4256-284-0x0000000009930000-0x0000000009963000-memory.dmp

                                  Filesize

                                  204KB

                                • memory/4256-270-0x0000000008AA0000-0x0000000008B16000-memory.dmp

                                  Filesize

                                  472KB

                                • memory/4256-257-0x0000000008160000-0x000000000817C000-memory.dmp

                                  Filesize

                                  112KB

                                • memory/4384-184-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4384-185-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4384-183-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4384-182-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4384-181-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4384-180-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4384-179-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4444-924-0x00000000005E0000-0x0000000000690000-memory.dmp

                                  Filesize

                                  704KB

                                • memory/4788-145-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-116-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-169-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-170-0x0000000005520000-0x000000000552A000-memory.dmp

                                  Filesize

                                  40KB

                                • memory/4788-171-0x00000000055F0000-0x0000000005656000-memory.dmp

                                  Filesize

                                  408KB

                                • memory/4788-117-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-118-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-119-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-120-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-121-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-122-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-167-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-166-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-165-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-164-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-163-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-162-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-161-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-160-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-159-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-158-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-157-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-156-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-155-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-154-0x00000000053C0000-0x0000000005452000-memory.dmp

                                  Filesize

                                  584KB

                                • memory/4788-153-0x00000000058C0000-0x0000000005DBE000-memory.dmp

                                  Filesize

                                  5.0MB

                                • memory/4788-152-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-151-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-150-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-149-0x0000000000AD0000-0x0000000000B78000-memory.dmp

                                  Filesize

                                  672KB

                                • memory/4788-148-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-147-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-146-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-168-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-144-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-143-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-142-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-141-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-140-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-139-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-138-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-137-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-136-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-135-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-134-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-133-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-123-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-132-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-131-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-130-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-124-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-125-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-129-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-127-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-128-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4788-126-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4940-177-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4940-175-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4940-176-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4940-174-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB

                                • memory/4940-173-0x00000000777D0000-0x000000007795E000-memory.dmp

                                  Filesize

                                  1.6MB